Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About ericnewman
ericnewman
Explorer
Member since:
08-01-2016
05-30-2023
Community Statistics
| Posts | 8 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 7 |
| Member Since | 08-01-2016 |
Activity Feed
- Got Karma for Re: Network Toolkit - Lookup whois - How to use. Friday
- Posted Re: Verification of SAML assertion using the IDP's certificate provided failed. Error: Failed to verify signature with c on Security. 02-23-2023 12:12 PM
- Got Karma for Intermittent Index Time Parsing Issues for IIS events?. 02-01-2023 03:38 PM
- Posted Intermittent Index Time Parsing Issues for IIS events? on Getting Data In. 01-09-2023 12:11 PM
- Got Karma for Re: Upgraded Splunk DB Connect V3.2.0 to V3.3.0 seeing metrics-logger-reporter errors. 05-17-2022 03:40 AM
- Posted Re: SentinelOne Applications Channel Input runs for days on All Apps and Add-ons. 12-21-2021 06:37 AM
- Posted Re: SentinelOne Applications Channel Input runs for days on All Apps and Add-ons. 12-14-2021 02:30 PM
- Posted SentinelOne Applications Channel Input runs for days on All Apps and Add-ons. 11-30-2021 07:45 AM
- Tagged SentinelOne Applications Channel Input runs for days on All Apps and Add-ons. 11-30-2021 07:45 AM
- Tagged SentinelOne Applications Channel Input runs for days on All Apps and Add-ons. 11-30-2021 07:45 AM
- Tagged SentinelOne Applications Channel Input runs for days on All Apps and Add-ons. 11-30-2021 07:45 AM
- Tagged SentinelOne Applications Channel Input runs for days on All Apps and Add-ons. 11-30-2021 07:45 AM
- Got Karma for Re: Network Toolkit - Lookup whois - How to use. 09-15-2021 05:35 AM
- Got Karma for Re: Network Toolkit - Lookup whois - How to use. 07-30-2021 09:33 AM
- Posted Re: How can I run a whois search on multiple IPs with one command? on All Apps and Add-ons. 05-25-2021 01:30 PM
- Posted Re: Network Toolkit - Lookup whois - How to use on All Apps and Add-ons. 05-25-2021 01:26 PM
- Got Karma for Re: Upgraded Splunk DB Connect V3.2.0 to V3.3.0 seeing metrics-logger-reporter errors. 09-18-2020 12:37 PM
- Posted Re: Upgraded Splunk DB Connect V3.2.0 to V3.3.0 seeing metrics-logger-reporter errors on All Apps and Add-ons. 07-29-2020 12:38 PM
Topics I've Started
02-23-2023
12:12 PM
In our case we were configuring Splunk for SAML authentication with Ping as the identity provider (IDP) with Splunk Enterprise version 8.2.7.1. After extensive troubleshooting we discovered that we needed a few check boxes in the Ping certificate configuration. INCLUDE THE CERTIFICATE IN THE SIGNATURE <KEYINFO> ELEMENT INCLUDE THE RAW KEY IN THE SIGNATURE <KEYVALUE> ELEMENT We discovered this after comparing the SAMLResponse between a working and non-working environment and noticing that the KeyInfo data was missing in the <ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>[CERTIFICATE TEXT REDACTED]
</ds:X509Certificate>
</ds:X509Data>
<ds:KeyValue>
<ds:RSAKeyValue>
<ds:Modulus>[MODULUS TEXT REDACTED]
</ds:Modulus>
<ds:Exponent>AQAB
</ds:Exponent>
</ds:RSAKeyValue>
</ds:KeyValue>
</ds:KeyInfo>
... View more
01-09-2023
12:11 PM
1 Karma
I am observing intermittent issues parsing IIS data. Splunk is configured for index time parsing of IIS events on the universal forwarders (INDEXED_EXCTRACTIONS). The extraction works fine for most events, but a small percentage (less than 1%) fail parsing.
I am detecting the events that fail parsing with the following SPL index=[IIS INDEXES] sourcetype=iis NOT c_ip=*
I have noticed an error in the splunkd.log on the universal forwarders that accounts for some of these issues. 04-06-2022 20:08:42.602 -0500 WARN CsvLineBreaker - Parser warning: Encountered unescaped quotation mark in field while parsing. This may cause inaccurate field extractions or corrupt/merged events. - data_source="e:\iis-logs\W3SVC1\u_ex220407.log", data_host="XXXXX", data_sourcetype="iis" In these cases, it appears that not only does index time field parsing fail but event breaking fails resulting many events getting lumped into a single event. This may not be avoidable and we’re at least able to point to a cause for these issues but many more are unexplained.
For most of the events that fail parsing the result is a single line event which appears to be formatted correctly but has no indexed fields. I was originally having an issue with these events reporting in the future as well but adding a time zone to props.conf seems to have at least resolved that issue.
I have upgraded through several versions (8.1.2, 8.2.3, 8.2.7.1) on the Universal forwarders and have seen this issue across all these versions.
If you have and ideas on what might be causing failures in index time parsing issues for IIS data I would love to hear them.
... View more
- Tags:
- iis
- ms:iis:auto
Labels
12-21-2021
06:37 AM
Thanks for the suggestions. We are running the inputs on a heavy forwarder with relatively light load, 12 CPUs and 12 GB memory. We made the changes to the number of threads available to the paginator as suggested and saw a measurable decrease in throughput. With 10 threads we were seeing about 9,000/hr with 50 threads we're seeing about 7,000/hr. The applications input will likely run event longer than 4 days now. If you have any other suggestions that would be great. Thanks again for the assistance.
... View more
12-14-2021
02:30 PM
@aplura_llc, Thank you for the response. It's helpful to understand that the applications and agents API are not time aware. How are the modular inputs designed to avoid ingesting the same data over and over? Per your recommendation I have adjusted the applications input interval to 86400 but I don't expect that to resolve the issue (note: the agent interval was already 86400). Based on the XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX-sentinelone-modularinput.log files. The agents input runs for about 40 minutes and processes 10,000-14,000 total items each run The applications input runs over 4 days and processes 700,000-1,000,000 total items each run and frequently hits the bulk_import_limit=1,000,000 This behavior appears to be fairly consistent over the past 90 days. Our concern is the long running applications input and the apparent duplication of effort. Is there anything else we can do to reduce the runtime of the applications modular input?
... View more
11-30-2021
07:45 AM
The sentinelone.py process for the applications channel input is running under a single PID for several days. It does not appear to be respecting the checkpoint. @aplura_llc_supp any assistance on whether this is expected behavior and if not how the issue might be resolved would be greatly appreciated. We have three Sentinel One input channels enabled (Agents, Threats, Applications). The modular input is configured with an interval of 300 for the threats channel seems to run fairly quickly (less than 2 minutes) and does not seem to be duplicating ingest. The modular input for the agents channel is configured with an interval of 86400 and seems to run in about 45 minutes to 1 hour but does seem to be duplicating ingest based on the following search. index=sentinelone_index sourcetype="sentinelone:channel:agents" earliest=1 latest=now
| rex mode=sed field=_raw "s/, \"modular_input_consumption_time\": \"\w{3}, \d{2} \w{3} \d{4} \d{2}:\d{2}:\d{2} (\+|\-)\d{4}\"/, \"modular_input_consumption_time\": \"\"/g"
| stats count as dup_count by _raw | stats count by dup_count The modular input for the applications channel is configured with an interval of 3600. It runs for multiple days with the same PID and seems to be duplicating ingest based on a similar search. It seems that it may not be respecting the checkpoint. The checkpoints for all three input channels appear to be getting set correctly on the following path $SPLUNK_HOME/var/lib/splunk/modinputs/sentinelone/. /opt/splunk/var/lib/splunk/modinputs/sentinelone/usea1-014.sentinelone.net_sentinelone-input-efd4172-40fe-b76-811f-c8cdf72132e-channel-applications.json {"next_page": "", "last_execution": "1637470721"} The input also appears to get the checkpoint successfully 2021-11-29 07:40:21,521 log_level=INFO pid=31196 tid=MainThread file="s1_client.py" function="get_channel" line_number="373" version="sentinelone_app_for_splunk.v5.1.2.b35" action=calling_applications_channel status=start start=1637470721000 start_length=13 start_type=<class 'str'> end=1638193221000 end_length=13 end_type=<class 'str'> checkpoint=1637470721 channel=applications
2021-11-29 07:40:21,521 log_level=WARNING pid=31196 tid=MainThread file="s1_client.py" function="get_channel" line_number="365" version="sentinelone_app_for_splunk.v5.1.2.b35" action=got_checkpoint checkpoint={'next_page': '', 'last_execution': '1637470721'} channel=applications The Input Add On for SentinelOne App For Splunk (IA-sentinelone_app_for_splunk) is installed on the heavy forwarder. The Input Add On for SentinelOne App For Splunk (TA-sentinelone_app_for_splunk) is installed on a search head cluster and a stand alone Enterprise Security search head. The SentinelOne App For Splunk is not currently installed. All input channels are producing events. Any ideas on how to troubleshoot and or resolve this issue would be appreciated.
... View more
- Tags:
- applications input
- IA-sentinelone_app_for_splunk
- Input Add On for SentinelOne App For Splunk
- sentinelone
Labels
- Labels:
-
troubleshooting
05-25-2021
01:30 PM
We were having the same problem and discovered that we was getting the below errors in the search.log (Job-->Inpect Job->Search job properties - search.log) even though there was no indication on an issue. We are running Splunk Enterprise version 8.1.2 which defaults to python3. We were able to get the lookups working by setting them to run as python2. We added a custom /opt/splunk/etc/apps/network_tools/local/transforms.conf. [whois]
python.version = python2
[nslookup]
python.version = python2
[traceroute]
python.version = python2
[ping]
python.version = python2
[portscan]
python.version = python2 Example Errors: 05-25-2021 15:14:39.784 INFO PreviewExecutor - Preview Enforcing initialization done
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': Exception in thread ping_lookup:
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': Traceback (most recent call last):
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/lib/python3.7/threading.py", line 926, in _bootstrap_inner
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': self.run()
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/lib/python3.7/threading.py", line 870, in run
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': self._target(*self._args, **self._kwargs)
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/etc/apps/network_tools/bin/network_tools_app/custom_lookup.py", line 253, in do_lookup
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': self.execute_lookup(result, w, fieldnames)
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/etc/apps/network_tools/bin/network_tools_app/custom_lookup.py", line 210, in execute_lookup
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': output = self.do_lookup(**keyword_arguments)
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/etc/apps/network_tools/bin/whois_lookup.py", line 55, in do_lookup
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': index = get_default_index()
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/etc/apps/network_tools/bin/network_tools_app/__init__.py", line 133, in get_default_index
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': app_config = get_app_config(session_key)
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/etc/apps/network_tools/bin/network_tools_app/__init__.py", line 106, in get_app_config
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': conf = ConfigParser.SafeConfigParser()
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': AttributeError: type object 'ConfigParser' has no attribute 'SafeConfigParser'
05-25-2021 15:14:40.270 INFO DispatchExecutor - END OPEN: Processor=noop
... View more
05-25-2021
01:26 PM
3 Karma
We were having the same problem and discovered that we was getting the below errors in the search.log (Job-->Inpect Job->Search job properties - search.log) even though there was no indication on an issue. We are running Splunk Enterprise version 8.1.2 which defaults to python3. We were able to get the lookups working by setting them to run as python2. We added a custom /opt/splunk/etc/apps/network_tools/local/transforms.conf. [whois]
python.version = python2
[nslookup]
python.version = python2
[traceroute]
python.version = python2
[ping]
python.version = python2
[portscan]
python.version = python2 Example Errors: 05-25-2021 15:14:39.784 INFO PreviewExecutor - Preview Enforcing initialization done
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': Exception in thread ping_lookup:
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': Traceback (most recent call last):
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/lib/python3.7/threading.py", line 926, in _bootstrap_inner
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': self.run()
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/lib/python3.7/threading.py", line 870, in run
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': self._target(*self._args, **self._kwargs)
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/etc/apps/network_tools/bin/network_tools_app/custom_lookup.py", line 253, in do_lookup
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': self.execute_lookup(result, w, fieldnames)
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/etc/apps/network_tools/bin/network_tools_app/custom_lookup.py", line 210, in execute_lookup
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': output = self.do_lookup(**keyword_arguments)
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/etc/apps/network_tools/bin/whois_lookup.py", line 55, in do_lookup
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': index = get_default_index()
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/etc/apps/network_tools/bin/network_tools_app/__init__.py", line 133, in get_default_index
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': app_config = get_app_config(session_key)
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': File "/opt/splunk/etc/apps/network_tools/bin/network_tools_app/__init__.py", line 106, in get_app_config
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': conf = ConfigParser.SafeConfigParser()
05-25-2021 15:14:40.222 ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/network_tools/bin/whois_lookup.py host': AttributeError: type object 'ConfigParser' has no attribute 'SafeConfigParser'
05-25-2021 15:14:40.270 INFO DispatchExecutor - END OPEN: Processor=noop
... View more
07-29-2020
12:38 PM
2 Karma
In my case this was resolved by clicking the Reset and Save buttons on the Configuration > Settings > Logging page in the DB Connect App and restarting Splunk. The Reset button created and/or updated the following two files. splunk_app_db_connect/bin/dbx2/rest/__pycache__/loglevel.cpython-37.pyc splunk_app_db_connect/bin/__pycache__/dbx_rh_loglevel.cpython-37.pyc The Save button created or updated the follwing files splunk_app_db_connect/jars/server.vmopts splunk_app_db_connect/jars/dbxquery.vmopts splunk_app_db_connect/local/dbx_settings.conf splunk_app_db_connect/metadata/local.meta
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-30-2023
02:58 PM
|
Karma from
